[compiler] Fix return type of GetCharAsString

.. which can return Undefined if reading out of bounds, so the return
type is ObjectRef and not StringRef (if we had torque-like union types
it'd be StringRef|OddballRef). Also change the function name to
GetCharAsStringOrUndefined.

Bug: v8:7790,chromium:1181246
Change-Id: Icf9e8fd03d11c3936e87a509b9117e547972d283
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712965Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72952}

src/compiler/heap-refs.h

@@ -917,7 +917,7 @@ class StringRef : public NameRef {
 
   Handle<String> object() const;
 
-  base::Optional<StringRef> GetCharAsString(
+  base::Optional<ObjectRef> GetCharAsStringOrUndefined(
       uint32_t index, SerializationPolicy policy =
                           SerializationPolicy::kAssumeSerialized) const;
 

src/compiler/js-heap-broker.cc

@@ -888,7 +888,7 @@ class StringData : public NameData {
   bool is_external_string() const { return is_external_string_; }
   bool is_seq_string() const { return is_seq_string_; }
 
-  ObjectData* GetCharAsString(
+  ObjectData* GetCharAsStringOrUndefined(
       JSHeapBroker* broker, uint32_t index,
       SerializationPolicy policy = SerializationPolicy::kAssumeSerialized);
 
@@ -932,8 +932,9 @@ class InternalizedStringData : public StringData {
   }
 };
 
-ObjectData* StringData::GetCharAsString(JSHeapBroker* broker, uint32_t index,
-                                        SerializationPolicy policy) {
+ObjectData* StringData::GetCharAsStringOrUndefined(JSHeapBroker* broker,
+                                                   uint32_t index,
+                                                   SerializationPolicy policy) {
   if (index >= static_cast<uint32_t>(length())) return nullptr;
 
   for (auto const& p : chars_as_strings_) {
@@ -3287,22 +3288,19 @@ ObjectRef MapRef::GetFieldType(InternalIndex descriptor_index) const {
   return ObjectRef(broker(), descriptors->GetFieldType(descriptor_index));
 }
 
-base::Optional<StringRef> StringRef::GetCharAsString(
+base::Optional<ObjectRef> StringRef::GetCharAsStringOrUndefined(
     uint32_t index, SerializationPolicy policy) const {
   if (data_->should_access_heap()) {
     // TODO(solanes, neis, v8:7790, v8:11012): Re-enable this optimization for
     // concurrent inlining when we have the infrastructure to safely do so.
     if (broker()->is_concurrent_inlining()) return base::nullopt;
     CHECK_EQ(data_->kind(), ObjectDataKind::kUnserializedHeapObject);
-    base::Optional<ObjectRef> maybe_result =
-        GetOwnElementFromHeap(broker(), object(), index, true);
-    if (!maybe_result) return {};
-    return maybe_result->AsString();
+    return GetOwnElementFromHeap(broker(), object(), index, true);
   }
   ObjectData* element =
-      data()->AsString()->GetCharAsString(broker(), index, policy);
+      data()->AsString()->GetCharAsStringOrUndefined(broker(), index, policy);
   if (element == nullptr) return base::nullopt;
-  return StringRef(broker(), element);
+  return ObjectRef(broker(), element);
 }
 
 base::Optional<int> StringRef::length() const {

src/compiler/js-native-context-specialization.cc

@@ -1980,7 +1980,7 @@ Reduction JSNativeContextSpecialization::ReduceElementLoadFromHeapConstant(
         }
       }
     } else if (receiver_ref.IsString()) {
-      element = receiver_ref.AsString().GetCharAsString(index);
+      element = receiver_ref.AsString().GetCharAsStringOrUndefined(index);
     }
 
     if (element.has_value()) {

src/compiler/serializer-for-background-compilation.cc

@@ -3338,7 +3338,7 @@ void SerializerForBackgroundCompilation::ProcessElementAccess(
                   SerializationPolicy::kSerializeIfNeeded);
             }
           } else if (receiver_ref.IsString()) {
-            element = receiver_ref.AsString().GetCharAsString(
+            element = receiver_ref.AsString().GetCharAsStringOrUndefined(
                 key_ref.AsSmi(), SerializationPolicy::kSerializeIfNeeded);
           }
         }

test/mjsunit/regress/regress-1181246.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+Object.defineProperty(String.prototype, "0", { __v_1: 1});
+var __f_2 = function() {
+  function __f_2() {
+    ''[0];
+  };
+  %PrepareFunctionForOptimization(__f_2);
+  return __f_2;
+}();
+%PrepareFunctionForOptimization(__f_2);
+__f_2();
+__f_2();
+%OptimizeFunctionOnNextCall(__f_2);
+__f_2();